1. Field of the Invention
The present invention pertains to monitoring and measuring behavior of a managed system. More particularly, this invention relates to accurately predicting system behavior of a managed system (e.g., a distributed application system) using an evolved predictor generated by genetic programming.
2. Description of the Related Art
As we know, one prior art monitoring solution for managing a software application running on a computer system employs predetermined static threshold values to measure the performance of the application. FIG. 1 shows this prior art solution. The threshold value used is typically based on experience and/or intuition. This prior art solution is acceptable for applications running on a single computer and involving very few measurements.
However, this prior art solution will not be suitable for measuring large dynamic distributed applications with hundreds of metrics. A distributed application system operates in a distributed or federated computing environment. Such an environment is typically characterized by independent computer systems in individual administrative domains that are loosely coupled by networks and cooperate to provide computing resources for a global application (i.e., the distributed application). One example of such a distributed application system is the Internet.
One reason that the above-mentioned prior art solution will not be suitable for the large dynamic distributed applications with hundreds of metrics is that this simple prior art solution is typically not sufficient to capture complex interactions between various metrics. In particular, it is not sufficient to capture complex correlation between metrics on different computer systems in different administrative or control domains. Another reason is that this prior art approach is not flexible enough to incorporate the dynamic behavior of the distributed application, which may radically change over time.
Another problem associated with the above-mentioned prior art solution is that the use of predetermined static threshold values is sensitive to spikes in the measured data. For example and as can be seen from FIG. 1, if the value of one measurement exceeds the threshold for a short period of time due to a transient malfunction of the application, alarms will go off, notifying the existence of a problem. This will result in increased false positives, which can be very annoying, and in some cases, very costly.
Another prior art approach to monitoring a system with thresholds is referred to as baselining. The main idea of baselining is to automatically determine the xe2x80x9cnormalxe2x80x9d or xe2x80x9cexpectedxe2x80x9d value of a metric or measurement. In general, a baseline is a representation of how a system behaves under normal conditions at various times. This is particularly useful for selecting threshold values that defines desirable or acceptable ranges for each of the metrics as a function of the baseline for that metric. FIG. 2 shows a threshold range that is defined as a function of the baseline 11. In FIG. 2, the curve 12 shows the upper threshold of the baseline 11 and the curve 13 shows the lower threshold of the baseline 11.
The advantage of this approach is the ability to automatically select threshold values that takes into account the dynamic behavior of the system being monitored. However, problems are still associated with this prior art baselining approach. One problem is that the approach does not capture relationships between metrics, which reduces its predictive power and limits its use to single metrics or predefined functions that represent known (and mostly simple) relationships. This means that the approach still looks at each individual measurement in isolation. Another problem associated with the approach is its sensitivity to several required parameters such as sampling rate and age factor. As a result, system behavior of the monitored system cannot be accurately predicted. The prior art approach can only indicate problems when the problems actually occur. One more problem of the prior art approach is its inability to classify problems. It can only tell if the event is normal or abnormal.
Thus, there exists a need for a predictor that can accurately predict system behavior of a distributed application system.
One feature of the present invention is to accurately and best predict the behavior of a system.
Another feature of the present invention is to predict the behavior of a system using genetic programming.
A further feature of the present invention is to define or generate an evolved predictor that accurately and best predicts the behavior of a system at any given time.
A still further feature of the present invention is to train a genetic programming module with past measurement data of a managed system to evolve a predictor that accurately and best predicts the behavior of the managed or instrumented system at any given time.
A system for defining or generating an evolved predictor for a managed or instrumented system is described. The evolved predictor predicts the behavior of the managed system. The system includes a store that stores past measurement data of the managed system. The past measurement data include an identified event of interest. The system also includes a genetic programming module coupled to the store to genetically manipulate a set of candidate predictors to evolve the predictor based on the past measurement data and fitness/effectiveness criteria such that the evolved predictor best predicts the event of interest of the system when the predictor is supplied with current measurement data of the managed system.
A system for monitoring the behavior of a distributed application system includes a measurement module coupled to the distributed application system to generate measurement data of the distributed application system. The measurement data include past measurement data and current measurement data. The past measurement data include one or more identified events of interest. A store is also provided that stores the past measurement data. A genetic programming module is coupled to the store to evolve the evolved predictor. The genetic programming module genetically manipulates a set of candidate predictors to produce the evolved predictor that best predicts the events of interest based on the past measurement data and predetermined fitness/effectiveness criteria when the predictor is supplied with the current measurement data of the distributed application system.
Other features and advantages of the present invention will become apparent from the following detailed description, taken in conjunction with the accompanying drawings, illustrating by way of example the principles of the invention.